Re: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID

From	Florian Westphal <fw@strlen.de>
Newsgroups	linux.kernel
Subject	Re: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID
Date	2017-06-30 22:00 +0200
Message-ID	<tYaf7-1dM-5@gated-at.bofh.it> (permalink)
References	<tY9M6-13z-3@gated-at.bofh.it> <tY9VL-16Y-3@gated-at.bofh.it> <tYa5r-1ah-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Richard Weinberger <richard@nod.at> wrote:
> Florian,
> 
> Am 30.06.2017 um 21:35 schrieb Florian Westphal:
> > Richard Weinberger <richard@nod.at> wrote:
> >> Hi!
> >>
> >> I noticed that nf_conntrack leaks kernel addresses, it uses the memory address
> >> as identifier used for generating conntrack and expect ids..
> >> Since these ids are also visible to unprivileged users via network namespaces
> >> I suggest reverting these commits:
> > 
> > Why not use a hash of the address?
> 
> Would also work. Or xor it with a random number.
> 
> On the other hand, for user space it would be more useful when the conntrack id
> does not repeat that often. That's why I favor the good old counter method.
> Currently the conntrack id is reused very fast.
> e.g. in one of our applications we use the conntack id via NFQUEUE and watch the
> destroy events via conntrack. It happens regularly that a new connection has the
> same id than a different connection we saw some moments before, before we receive
> the destroy event from the conntrack socket.

Perhaps we can place that in a new extension (its not needed in any
fastpath ops)?

Thread

nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID Richard Weinberger <richard@nod.at> - 2017-06-30 21:30 +0200
  Re: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID Florian Westphal <fw@strlen.de> - 2017-06-30 21:40 +0200
    Re: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID Richard Weinberger <richard@nod.at> - 2017-06-30 21:50 +0200
      Re: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID Florian Westphal <fw@strlen.de> - 2017-06-30 22:00 +0200
        Re: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID Richard Weinberger <richard@nod.at> - 2017-06-30 22:30 +0200
          Re: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID Pablo Neira Ayuso <pablo@netfilter.org> - 2017-07-01 11:50 +0200
          Re: nf_conntrack: Infoleak via CTA_ID and CTA_EXPECT_ID Florian Westphal <fw@strlen.de> - 2017-07-01 12:40 +0200

csiph-web